Restrict workspace-level settings to admins

[RhysSullivan]

Members can still USE workspace resources — read them, execute tools over shared connections, and the operational writes those imply (token refresh, tool-catalog re-sync, config-rewrite healing) — but CONFIGURING them is now admin-only.

What's gated

The executor binding gains orgWrites: "allowed" | "denied", enforced at the top of every user-intent workspace-level mutation with a new OrgWriteDeniedError (403):

• org-owned tool policies (create/update/remove)
• workspace-shared connections (create/update/remove, org OAuth connect/reconnect)
• org OAuth apps (create/remove, incl. DCR persisting an org client)
• the integration catalog (new registration, update, remove, health check) — including the plugin extension surfaces (openapi addSpec/updateSpec/configure, mcp add/remove/configure server, graphql add/configure)

Deliberately a surface gate rather than a storage-policy axis: catalog rebuilds, legacy stdio healing, and OAuth token refresh on shared connections must keep converging under any member's binding.

Role plumbing

• cloud: authorizeOrganization now surfaces the WorkOS membership role (no extra API call); HTTP requests and MCP sessions bind from it. MCP sessions bake the role at session init, so a demotion applies from the next session, and sessions persisted before this field existed keep their old behavior until re-init.
• self-host: the identity seam resolves the Better Auth org membership role (same explicit-org query as the admin gate); the MCP OAuth-bearer path reads the membership row directly. Fails closed to member.
• local / CLI / host-cf (single-tenant Access): no role model, binding stays allowed.

Tests

• packages/core/sdk/src/org-writes.test.ts: denied vs allowed bindings across policies, connections, catalog, OAuth — including that members still execute tools over org connections and that the register replace-arm stays open.
• apps/host-selfhost/src/multi-user.test.ts: member 403s end-to-end through real Better Auth; admin setup unchanged.
• Full repo gates green (format:check, lint, typecheck, test). apps/cloud/src/account/org-api-key-revoke.node.test.ts fails on main already (pre-existing, untouched).

Not in this PR

Console UI affordance (hiding the Workspace owner option and catalog mutations for non-admins) — the server now answers 403 and the console renders the error; the nav-level admin gate (packages/react/src/lib/admin-access.ts) already exists to build on.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	2c3d52f	Commit Preview URL Branch Preview URL	Aug 12 2026, 10:02 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	2c3d52f	Aug 12 2026, 10:04 PM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1571

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1571

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1571

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1571

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1571

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1571

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1571

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1571

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1571

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1571

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1571

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1571

executor

npm i https://pkg.pr.new/executor@1571

commit: 2c3d52f